PT-2014-5532 · Centreon · Centreon Enterprise Server+1

Maz + 1 · Publicado 2014-10-23 · Atualizado 2019-07-30 · CVE-2014-3829

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Centreon versions 2.5.1 through 2.5.2 Centreon Enterprise Server version 2.2

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the session id or template id parameter, related to the command line variable. This is a command execution issue that can be exploited by sending malicious input to the displayServiceStatus.php script.

Recommendations For Centreon versions 2.5.1 through 2.5.2, update to version 2.5.3 or later to resolve the issue. For Centreon Enterprise Server version 2.2, update to a version that includes the fix for this issue, as the specific fixed version is not provided. As a temporary workaround, consider restricting access to the displayServiceStatus.php script to minimize the risk of exploitation. Avoid using the session id and template id parameters in the displayServiceStatus.php script until the issue is resolved.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-3829

Produtos afetados

Centreon

Centreon Enterprise Server

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/centreon_sqli_exec.rb · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Oct/78 · Exploit
• 🔥 https://exploit-db.com/exploits/41676 · Exploit
• https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde · Nota
• http://kb.cert.org/vuls/id/298796 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3829 · Nota de Segurança
• https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3829 · Nota